Back to Details

cx-alerts

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Alert Management Skill

警报管理Skill

Use this skill to list, inspect, create, enable, and disable Coralogix alert definitions using the 
cx alerts
CLI commands.
使用此Skill通过
cx alerts
CLI命令来列出、查看、创建、启用和禁用Coralogix警报定义。

CLI Commands

CLI命令

CommandPurposeKey flags
cx alerts list
List all alert definitions
--name <filter>
cx alerts get <id>
Get a single alert definition by ID-
cx alerts create
Create an alert from a JSON definition
--from-file <path>
(default: stdin)
cx alerts enable <id>
Enable an alert-
cx alerts disable <id>
Disable an alert-
cx alerts events
List alert trigger events
--alert-id
, 
--start
, 
--end
cx alerts event-stats
Get alert event statistics-
cx alerts suppression-rules list
List suppression rules-
cx alerts suppression-rules get <id>
Get a suppression rule-
cx alerts suppression-rules create
Create a suppression rule
--from-file <path>
cx alerts suppression-rules update
Update a suppression rule
--from-file <path>
cx alerts suppression-rules delete <id>
Delete a suppression rule-
Output format: append 
-o json
or 
-o agents
to 
list
, 
get
, and 
create
commands for machine-readable output.
Multi-profile: use 
-p <profile>
(repeatable) to target multiple profiles simultaneously.
命令用途关键参数
cx alerts list
列出所有警报定义
--name <filter>
cx alerts get <id>
通过ID获取单个警报定义-
cx alerts create
通过JSON定义创建警报
--from-file <path>
（默认：标准输入）
cx alerts enable <id>
启用警报-
cx alerts disable <id>
禁用警报-
cx alerts events
列出警报触发事件
--alert-id
, 
--start
, 
--end
cx alerts event-stats
获取警报事件统计数据-
cx alerts suppression-rules list
列出抑制规则-
cx alerts suppression-rules get <id>
获取抑制规则-
cx alerts suppression-rules create
创建抑制规则
--from-file <path>
cx alerts suppression-rules update
更新抑制规则
--from-file <path>
cx alerts suppression-rules delete <id>
删除抑制规则-
输出格式： 在
list
、
get
和
create
命令后追加
-o json
或
-o agents
，以获取机器可读的输出。
多配置文件： 使用
-p <profile>
（可重复使用）同时针对多个配置文件。

Alert Types Reference

警报类型参考

Coralogix supports 12 alert types:
Type enumHuman nameDescription
ALERT_DEF_TYPE_LOGS_IMMEDIATE
Logs ImmediateTrigger on every matching log entry
ALERT_DEF_TYPE_LOGS_THRESHOLD
Logs ThresholdTrigger when log count exceeds a threshold in a time window
ALERT_DEF_TYPE_LOGS_ANOMALY
Logs AnomalyML-based anomaly detection on log volume
ALERT_DEF_TYPE_LOGS_RATIO_THRESHOLD
Logs Ratio ThresholdTrigger on ratio between two log queries
ALERT_DEF_TYPE_LOGS_NEW_VALUE
Logs New ValueTrigger when a new value appears in a field
ALERT_DEF_TYPE_LOGS_UNIQUE_COUNT
Logs Unique CountTrigger on unique value count threshold
ALERT_DEF_TYPE_LOGS_TIME_RELATIVE_THRESHOLD
Logs Time RelativeCompare current vs past time window
ALERT_DEF_TYPE_METRIC_THRESHOLD
Metric ThresholdTrigger when a PromQL expression crosses a threshold
ALERT_DEF_TYPE_METRIC_ANOMALY
Metric AnomalyML-based anomaly detection on metrics
ALERT_DEF_TYPE_TRACING_IMMEDIATE
Tracing ImmediateTrigger on every matching span
ALERT_DEF_TYPE_TRACING_THRESHOLD
Tracing ThresholdTrigger when span count exceeds a threshold
ALERT_DEF_TYPE_FLOW
FlowSequence-based alert combining multiple conditions
Coralogix支持12种警报类型：
类型枚举中文名称描述
ALERT_DEF_TYPE_LOGS_IMMEDIATE
即时日志警报每匹配一条日志条目就触发
ALERT_DEF_TYPE_LOGS_THRESHOLD
日志阈值警报当时间窗口内日志数量超过阈值时触发
ALERT_DEF_TYPE_LOGS_ANOMALY
日志异常警报基于机器学习的日志量异常检测
ALERT_DEF_TYPE_LOGS_RATIO_THRESHOLD
日志比率阈值警报基于两个日志查询之间的比率触发
ALERT_DEF_TYPE_LOGS_NEW_VALUE
日志新值警报当字段中出现新值时触发
ALERT_DEF_TYPE_LOGS_UNIQUE_COUNT
日志唯一值计数警报当唯一值计数达到阈值时触发
ALERT_DEF_TYPE_LOGS_TIME_RELATIVE_THRESHOLD
日志时间相对阈值警报比较当前与过去时间窗口的数据
ALERT_DEF_TYPE_METRIC_THRESHOLD
指标阈值警报当PromQL表达式超过阈值时触发
ALERT_DEF_TYPE_METRIC_ANOMALY
指标异常警报基于机器学习的指标异常检测
ALERT_DEF_TYPE_TRACING_IMMEDIATE
即时追踪警报每匹配一条追踪跨度就触发
ALERT_DEF_TYPE_TRACING_THRESHOLD
追踪阈值警报当追踪跨度数量超过阈值时触发
ALERT_DEF_TYPE_FLOW
流程警报结合多个条件的基于序列的警报

Priority Levels

优先级级别

Always ask the user what priority to use when creating alerts:
PriorityUse case
P1Critical - pages on-call immediately
P2High - needs attention within the hour
P3Medium - investigate during business hours
P4Low - informational, check when convenient
P5Info - logging/tracking only
创建警报时，务必询问用户要使用的优先级：
优先级使用场景
P1严重 - 立即呼叫值班人员
P2高 - 需在1小时内处理
P3中 - 在工作时间内调查
P4低 - 信息性，方便时查看
P5通知 - 仅用于记录/追踪

Create Workflow

创建流程

  1. Ask the user what they want to alert on (logs, metrics, traces)
  2. Ask for priority (P1–P5)
  3. Build the JSON payload with 
    alertDefProperties
    - use the API wire format (see 
    references/alert-schemas.md
    for all enum values)
  4. Tip: use 
    cx alerts get <existing-id> -o json
    to get a working template, modify it, and pipe into create
  5. Create using: 
    echo '<json>' | cx alerts create
    or 
    cx alerts create --from-file alert.json
  6. Verify with 
    cx alerts list --name "<alert name>"
Important structural note: The 
type
field is a string enum (e.g. 
"ALERT_DEF_TYPE_LOGS_THRESHOLD"
), and the alert type config (e.g. 
"logsThreshold": {...}
) is a sibling field at the same level - NOT nested inside 
type
.
  1. 询问用户要针对什么设置警报（日志、指标、追踪）
  2. 询问优先级（P1–P5）
  3. 构建包含
    alertDefProperties
    的JSON负载 - 使用API有线格式（所有枚举值请参见
    references/alert-schemas.md
    ）
  4. 提示： 使用
    cx alerts get <existing-id> -o json
    获取可用模板，修改后通过管道传入创建命令
  5. 通过以下方式创建：
    echo '<json>' | cx alerts create
    或 
    cx alerts create --from-file alert.json
  6. 使用
    cx alerts list --name "<alert name>"
    验证创建结果
重要结构说明： 
type
字段是字符串枚举（例如
"ALERT_DEF_TYPE_LOGS_THRESHOLD"
），警报类型配置（例如
"logsThreshold": {...}
）是同一层级的同级字段 - 不要嵌套在
type
内部。

Example: Logs Threshold Alert

示例：日志阈值警报

json
{
  "alertDefProperties": {
    "name": "High Error Rate",
    "description": "Alert when error logs exceed threshold",
    "priority": "ALERT_DEF_PRIORITY_P2",
    "type": "ALERT_DEF_TYPE_LOGS_THRESHOLD",
    "enabled": true,
    "logsThreshold": {
      "logsFilter": {
        "simpleFilter": {
          "luceneQuery": "severity:ERROR",
          "labelFilters": {
            "applicationName": [
              { "operation": "LOG_FILTER_OPERATION_TYPE_IS_OR_UNSPECIFIED", "value": "my-app" }
            ]
          }
        }
      },
      "rules": [{
        "condition": {
          "conditionType": "LOGS_THRESHOLD_CONDITION_TYPE_MORE_THAN_OR_UNSPECIFIED",
          "threshold": 100,
          "timeWindow": {
            "logsTimeWindowSpecificValue": "LOGS_TIME_WINDOW_VALUE_MINUTES_5_OR_UNSPECIFIED"
          }
        }
      }]
    }
  }
}
json
{
  "alertDefProperties": {
    "name": "High Error Rate",
    "description": "Alert when error logs exceed threshold",
    "priority": "ALERT_DEF_PRIORITY_P2",
    "type": "ALERT_DEF_TYPE_LOGS_THRESHOLD",
    "enabled": true,
    "logsThreshold": {
      "logsFilter": {
        "simpleFilter": {
          "luceneQuery": "severity:ERROR",
          "labelFilters": {
            "applicationName": [
              { "operation": "LOG_FILTER_OPERATION_TYPE_IS_OR_UNSPECIFIED", "value": "my-app" }
            ]
          }
        }
      },
      "rules": [{
        "condition": {
          "conditionType": "LOGS_THRESHOLD_CONDITION_TYPE_MORE_THAN_OR_UNSPECIFIED",
          "threshold": 100,
          "timeWindow": {
            "logsTimeWindowSpecificValue": "LOGS_TIME_WINDOW_VALUE_MINUTES_5_OR_UNSPECIFIED"
          }
        }
      }]
    }
  }
}

Example: Metric Threshold Alert

示例：指标阈值警报

json
{
  "alertDefProperties": {
    "name": "CPU Usage Critical",
    "priority": "ALERT_DEF_PRIORITY_P1",
    "type": "ALERT_DEF_TYPE_METRIC_THRESHOLD",
    "enabled": true,
    "metricThreshold": {
      "metricFilter": { "promql": "avg(cpu_usage_percent)" },
      "rules": [{
        "condition": {
          "conditionType": "METRIC_THRESHOLD_CONDITION_TYPE_MORE_THAN_OR_UNSPECIFIED",
          "threshold": 90,
          "ofTheLast": { "dynamicDuration": "5m" },
          "forOverPct": 100
        }
      }]
    }
  }
}
json
{
  "alertDefProperties": {
    "name": "CPU Usage Critical",
    "priority": "ALERT_DEF_PRIORITY_P1",
    "type": "ALERT_DEF_TYPE_METRIC_THRESHOLD",
    "enabled": true,
    "metricThreshold": {
      "metricFilter": { "promql": "avg(cpu_usage_percent)" },
      "rules": [{
        "condition": {
          "conditionType": "METRIC_THRESHOLD_CONDITION_TYPE_MORE_THAN_OR_UNSPECIFIED",
          "threshold": 90,
          "ofTheLast": { "dynamicDuration": "5m" },
          "forOverPct": 100
        }
      }]
    }
  }
}

Example: Logs Immediate Alert

示例：即时日志警报

json
{
  "alertDefProperties": {
    "name": "OOM Killer Detected",
    "description": "Alert immediately when OOM killer runs",
    "priority": "ALERT_DEF_PRIORITY_P1",
    "type": "ALERT_DEF_TYPE_LOGS_IMMEDIATE_OR_UNSPECIFIED",
    "enabled": true,
    "logsImmediate": {
      "logsFilter": {
        "simpleFilter": {
          "luceneQuery": "\"Out of memory\" OR \"OOM\"",
          "labelFilters": {}
        }
      }
    }
  }
}
json
{
  "alertDefProperties": {
    "name": "OOM Killer Detected",
    "description": "Alert immediately when OOM killer runs",
    "priority": "ALERT_DEF_PRIORITY_P1",
    "type": "ALERT_DEF_TYPE_LOGS_IMMEDIATE_OR_UNSPECIFIED",
    "enabled": true,
    "logsImmediate": {
      "logsFilter": {
        "simpleFilter": {
          "luceneQuery": "\"Out of memory\" OR \"OOM\"",
          "labelFilters": {}
        }
      }
    }
  }
}

Investigation Workflow

调查流程

Find firing alerts

查找触发中的警报

bash
undefined
bash
undefined

List all alerts and look for ALERTING status

列出所有警报并查找状态为ALERTING的警报

cx alerts list -o json | jq '.[] | select(.status == "ALERTING")'
cx alerts list -o json | jq '.[] | select(.status == "ALERTING")'

Filter by name

按名称过滤

cx alerts list --name "error"
undefined
cx alerts list --name "error"
undefined

Inspect a specific alert

查看特定警报详情

bash
cx alerts get <alert-id>
cx alerts get <alert-id> -o json
bash
cx alerts get <alert-id>
cx alerts get <alert-id> -o json

Disable a noisy alert (temporary mute)

禁用噪音警报（临时静音）

bash
cx alerts disable <alert-id>
bash
cx alerts disable <alert-id>

Later, re-enable:

之后重新启用：

cx alerts enable <alert-id>
undefined
cx alerts enable <alert-id>
undefined

Suppression Rules

抑制规则

Manage alert suppression rules that mute alerts during maintenance windows or known noisy periods.
CommandPurpose
cx alerts suppression-rules list
List all suppression rules
cx alerts suppression-rules get <id>
Get a suppression rule by ID
cx alerts suppression-rules create --from-file
Create a suppression rule
cx alerts suppression-rules update --from-file
Update a suppression rule
cx alerts suppression-rules delete <id>
Delete a suppression rule
bash
undefined
管理警报抑制规则，可在维护窗口或已知噪音时段内静音警报。
命令用途
cx alerts suppression-rules list
列出所有抑制规则
cx alerts suppression-rules get <id>
通过ID获取抑制规则
cx alerts suppression-rules create --from-file
创建抑制规则
cx alerts suppression-rules update --from-file
更新抑制规则
cx alerts suppression-rules delete <id>
删除抑制规则
bash
undefined

List suppression rules

列出抑制规则

cx alerts suppression-rules list -o json
cx alerts suppression-rules list -o json

Create from template

从模板创建

cx alerts suppression-rules get <existing-id> -o json > suppression-rule.json
cx alerts suppression-rules get <existing-id> -o json > suppression-rule.json

Edit suppression-rule.json

编辑suppression-rule.json

cx alerts suppression-rules create --from-file suppression-rule.json
undefined
cx alerts suppression-rules create --from-file suppression-rule.json
undefined

Key Principles

核心原则

  • Always ask for priority (P1–P5) when creating alerts - never assume
  • Use 
    --name
    filter     for large accounts with many alerts
  • Use 
    -o json
    with 
    jq
     for filtering and transformation
  • Use 
    --from-file -
     to pipe JSON from stdin when constructing alerts programmatically
  • Verify after create - always list or get the alert after creation to confirm
  • Disable, don't delete - prefer disabling alerts over deletion for auditability
  • 创建警报时务必询问优先级（P1–P5）- 切勿自行假设
  • 针对拥有大量警报的大型账户，使用
    --name
    过滤器
  • 将
    -o json
    与
    jq
    配合使用    进行过滤和转换
  • **编程构建警报时，使用
    --from-file -
    **从标准输入管道传入JSON
  • 创建后验证 - 务必在创建后列出或获取警报以确认结果
  • 禁用而非删除 - 为了可审计性，优先选择禁用警报而非删除

Additional Resources

额外资源

Reference Files

参考文件

  • references/alert-schemas.md
     - Complete JSON schema reference for all 12 alert types: field names, enum values (condition types, time windows, filter operations), common sub-objects (logs filter, tracing filter, notification groups, activity schedules), and important gotchas
  • references/alert-schemas.md
     - 所有12种警报类型的完整JSON架构参考：字段名称、枚举值（条件类型、时间窗口、过滤操作）、常见子对象（日志过滤器、追踪过滤器、通知组、活动计划）以及重要注意事项

Related Skills

相关Skills

  • cx-incident-management
     - incident triage workflows that involve alerts, SLO monitoring, and notification verification
  • cx-observability-setup
     - setting up notification routing and webhook integrations for alerts
  • cx-telemetry-querying
     - gateway for deciding which telemetry pillar to query
  • cx-incident-management
     - 涉及警报、SLO监控和通知验证的事件分类流程
  • cx-observability-setup
     - 为警报设置通知路由和Webhook集成
  • cx-telemetry-querying
     - 用于决定查询哪个遥测支柱的网关